Beyond ticketing: How Pipedrive leverages TheHive to improve security workflows

The story of Pipedrive started just like the story of StrangeBee and TheHive.

Over 10 years ago, a small group of sales professionals was looking for a CRM (Customer Relationship Management) platform that could do more than what the market could offer. They needed an easy-to-use, effective tool that would centralize all the essential data, helping users visualize the entire sales process and win more deals.

So, they created their own, and this is how Pipedrive was born. Their thoughtfully developed CRM platform eventually hit the spot for fellow salespeople all over the world. Today, more than 100,000 companies worldwide use it, and the Pipedrive team consists of ​850+ people across 8 countries.

The company’s ​c​ybersecurity team is extremely committed to safeguarding such an extensive global infrastructure and its sensitive data. For this, they need reliable, efficient and versatile tools.

This success story is about how TheHive became one of the core elements of the team’s workflows as a highly customizable and flexible ticketing and case management system.

Before fully committing to TheHive, the cybersecurity team at Pipedrive evaluated several alternatives, including traditional ticketing systems (like Jira and Confluence), as well as other security-focused platforms.

Eventually, TheHive became the perfect choice. From early open-source versions (starting with v3 and v4) to the latest v5, it has been a key part of the team’s workflow.

TheHive is tightly integrated with the team’s custom-built security orchestration, automation and response (SOAR) platform.

The SOAR platform ingests alerts from multiple sources and connects to Pipedrive’s 3rd-party tools. The team built it to seamlessly integrate their alerting systems, automate most of their responses via playbooks and ultimately manage investigations (alerts, cases and incidents) from “Create” to “Close” much more effectively and efficiently.

Among other things, the custom SOAR allows the team to identify new alerts, prioritize and escalate cases and generate analytics.

Working in close bond with the SOAR platform, TheHive is a critical element of the team’s alert and case management workflow.

Here’s how the team uses the platform:

The team relies heavily on TheHive’s API, using around 20 different endpoints for actions like:

• Creating and promoting alerts to cases
• Analyzing observables to gather threat intelligence
• Adding attachments, like screenshots as evidence
• Retrieving information using search features

The API allows them to integrate TheHive with the custom SOAR system, Slack and other security tools. The automated data ingestion and tool collaboration reduces manual work and makes their workflow more efficient.

TheHive serves as the team’s internal ticketing system for tracking security incidents. It is more security-focused and flexible compared to other ticketing systems. It provides a clear, structured and user-friendly way to manage alerts and cases.

The analysts use TheHive to close alerts, attach files and document security cases. It also acts as a historical database for incidents and security-related actions.

The improved search functionality in version 5 of TheHive allows ​​the team to find relevant alerts and cases much more easily. Quick access to past cases helps resolve incidents faster and more efficiently.

The team also uses TheHive to generate dashboards. They display metrics and trends, reducing the need for manual reporting, and provide security insights for management: they can track security operations without needing direct access to alerts and cases.

The dashboards also help management to have a better, clearer vision of the trends in seconds, thanks to the visual representation of the data.

TheHive allows the team to close multiple false-positive alerts at once by marking them as false positives and adding a single summary.

The team uses custom fields to categorize cases (e.g., policy violation, phishing, malware). Tags, on the other hand, help them differentiate between cases and incidents, something they found challenging before.

The analysts use Slack to create cases, close alerts and trigger investigations with the push of a button. Slack acts as an alternative way to interact with TheHive, even from their phones.

This integration allows quick response times without needing direct access to TheHive’s UI.

SOAR receives alerts from multiple sources. One source is Wazuh; it generates alerts based on defined rules. SOAR then filters these alerts before forwarding them to TheHive.

Once an alert enters TheHive, it triggers Slack notifications for the team and, for high-severity ​​alerts, an automated phone call to the on-call person.

This ensures that only actionable alerts reach TheHive, reducing unnecessary noise and improving response efficiency. Overall, the team gets 80-100 alerts per week.

The team has developed a highly responsive, time-saving workflow by integrating TheHive, Slack and their custom-built SOAR platform. Analysts can take action directly from Slack using convenient buttons that trigger TheHive’s API—allowing them to create cases, close alerts or run responders without switching tools.

These custom responders run pre-defined actions according to the team’s playbooks, perfectly tailored to Pipedrive’s context. Analysts can initiate actions like opening a new case when an alert is received, closing a false positive​ or logging incident actions to the incident timeline.

This ​versatile setup allows for fast incident handling, even from a mobile phone.

To differentiate between cases and incidents, the team relies on TheHive’s tags and custom fields to categorize events accordingly.

TheHive has become an essential tool in security operations at Pipedrive.

As the cybersecurity team continues to evolve, TheHive will remain a key part of its infrastructure as a ticketing and case management system. The team will continue to use and refine their existing workflows featuring the platform, and there are plans to automate more processes to allow the analysts to focus on higher-value tasks.